CVE-2026-43685

A Remote Code Execution vulnerability in Claris FileMaker Cloud allowed a user with Admin Console privileges to inject arbitrary operating system commands through unsanitized input in the External ODBC Data Source connection test feature. This issue is fixed in FileMaker Cloud 2.22.0.5.

CVSS v3 7.2 HIGH

7.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://support.claris.com/s/answerview?anum=000049154&language=en_US	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:claris:filemaker_cloud:*:*:*:*:*:*:*:*

History

26 Oct 2026, 18:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de ejecución remota de código en Claris FileMaker Cloud permitió a un usuario con privilegios de la Consola de Administración inyectar comandos arbitrarios del sistema operativo a través de una entrada no saneada en la función de prueba de conexión de la Fuente de Datos ODBC Externa. Este problema está solucionado en FileMaker Cloud 2.22.0.5.

Information

Published : 2026-05-12 23:16

Updated : 2026-10-26 18:10

NVD link : CVE-2026-43685

Mitre link : CVE-2026-43685

CVE.ORG link : CVE-2026-43685

JSON object : View

Products Affected

claris

filemaker_cloud

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2026-43685", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-43685", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-13T00:17:08.446075Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "affected": [{"source": "product-security@apple.com", "affectedData": [{"vendor": "Claris", "product": "FileMaker Cloud", "versions": [{"status": "affected", "version": "0", "lessThan": "2.22.0.5", "versionType": "custom"}]}]}], "published": "2026-05-12T23:16:17.973", "references": [{"url": "https://support.claris.com/s/answerview?anum=000049154&language=en_US", "tags": ["Vendor Advisory"], "source": "product-security@apple.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "A Remote Code Execution vulnerability in Claris FileMaker Cloud allowed a user with Admin Console privileges to inject arbitrary operating system commands through unsanitized input in the External ODBC Data Source connection test feature. This issue is fixed in FileMaker Cloud 2.22.0.5."}, {"lang": "es", "value": "Una vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo en Claris FileMaker Cloud permiti\u00f3 a un usuario con privilegios de la Consola de Administraci\u00f3n inyectar comandos arbitrarios del sistema operativo a trav\u00e9s de una entrada no saneada en la funci\u00f3n de prueba de conexi\u00f3n de la Fuente de Datos ODBC Externa. Este problema est\u00e1 solucionado en FileMaker Cloud 2.22.0.5."}], "lastModified": "2026-10-26T18:10:00.173", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:claris:filemaker_cloud:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A0DBAD4E-B906-4130-8D79-FBDD67974E60", "versionEndExcluding": "2.22.0.5"}], "operator": "OR"}]}], "sourceIdentifier": "product-security@apple.com"}